A service chain is composed of a sequence of service function instances that reside on various service nodes. When a traffic flow is forwarded over a service chain, the packets are processed by the various service function instances, with each service function instance applying a service function (e.g., firewall, network access translation (NAT), deep packet inspection (DPI), etc.) prior to forwarding the packet to the next service node. In some implementations, a service function instance may only need to access the first few packets of a traffic flow to perform the function, or to determine whether the function needs to be performed on the flow. For instance, a service function instance receiving a particular type of traffic flow (e.g., a long-lived flow) may complete the service function using the initial packets and without processing/receiving subsequent packets of the flow. As one example, a service function instance performing firewall processing may determine that a flow is benign based on the initial packets. As another example, a service function instance performing DPI processing may only need to inspect the first few packets of a traffic flow to extract the identification information. As yet another example, a service function instance performing content delivery network (CDN) caching may learn early on that content in a traffic flow does not satisfy a caching criterion, at which point there is no processing (e.g., caching) to be performed on the remaining packets.